Boeing EU-U.S., UK Extension to the EU-U.S., and Swiss-U.S. Data Privacy Framework Statement
The Boeing Company and its U.S. subsidiaries Boeing Distribution, Inc. and Boeing Distribution Services, Inc. (for the purposes of this section, collectively referred to as "Boeing DPF Companies") participate in the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) ( collectively, the “DPF”) as set forth by the U.S. Department of Commerce. Boeing DPF Companies have certified to the U.S. Department of Commerce that they adhere to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of Personal Information received from the European Union and United Kingdom (and Gibraltar) in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Boeing DPF Companies have certified to the U.S. Department of Commerce that they adhere to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of Personal Information received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Statement and the DPF Principles (collectively, the “Principles”), the Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Boeing DPF Companies implement these Principles with respect to the Personal Information described in this Statement and according to the stated purposes for which such Personal Information is collected, used, shared, and retained. If we transfer Personal Information to a third party, the third party’s access, use, and disclosure of the Personal Information as well as any onward transfer of that information must also be in compliance with the DPF, and we may be liable under the DPF for certain failures by the third party to comply with the Principles. Please note that Boeing DPF Companies may disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. EU, UK, and Swiss individuals have rights to access Personal Information about them, and to limit use and disclosure of their Personal Information. To exercise your rights and choices please visit Boeing’s Rights Exercise Portal at https://boeing.com/privacy/rightsrequestportal. If you have any inquiries or complaints relating to Boeing DPF Companies’ handling of Personal Information received under the DPF, please Contact Us.
Boeing DPF Companies are subject to the investigatory and enforcement powers of the Federal Trade Commission. In compliance with the DPF, Boeing DPF Companies commit to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on DPF in the context of the employment relationship. You may, under certain conditions, invoke binding arbitration. To learn more about these conditions and how to invoke binding arbitration, please visit https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.
Processing of Special Categories of Personal Information
Where Boeing collects Sensitive Personal Information, then it will only Process such information where it has an additional legal basis, including:
- where necessary for the purposes of carrying out obligations and exercising specific rights in the field of employment and social security laws;
- to assess working capacity and/or make reasonable adjustments;
- to protect the vital interests of you or another person;
- for the establishment, exercise or defense of legal claims;
- where Processing relates to Personal Information that has been manifestly made public;
- where Processing is necessary for reasons of substantial public interest, including for example where:
- Processing of Personal Information relates to race or ethnicity is necessary for equalities monitoring purposes; and/or
- Processing of Personal Information relates to criminal offences is necessary to prevent or detect unlawful acts, or to enable compliance with applicable regulatory requirements.
In limited circumstances, we may approach you for your explicit written consent to allow us to Process Sensitive Personal Information. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of any contract with us that you agree to any request for consent from us.